v0 app with OpenAI: AI launch checklist
v0 apps call OpenAI models through Vercel AI Gateway: no OpenAI account or key, and usage is billed through Vercel AI Gateway. Of the 20 checks before you charge users, v0 handles 2, partly handles 4, and leaves 14 to you.
Checked 12 Nov 2026 against each platform's docs; every fact links to its source.
How AI calls work in v0
- Built-in AI
- Yes: 'By default, v0 uses the Vercel AI Gateway'; v0 'is pre-configured to connect to the gateway'. Vercel's blog says provider tokens are used server-side only with short-lived OIDC tokens scoped per project.
- Other options
- Marketplace AI providers (fal, Deep Infra) and Grok by xAI via Project menu ... → Settings → Integrations; or direct provider keys as environment variables (docs example: OPEN_AI_API_KEY).
- Who pays
- Your Vercel team's AI Gateway Credits: provider list price, no markup or platform fee on tokens. Free tier covers a subset of models with lower per-model rate limits; buying credits moves you to the paid tier. BYOK needs purchased credits; failed BYOK requests are retried with system credentials and charged to your credits. Optional add-ons (custom reporting, team-wide ZDR, regional hosting at 5%) are surcharges.
- Models and providers
- OpenAI, Anthropic, Google and OpenRouter-style multi-provider access all go through AI Gateway's catalog; fal is a separate Marketplace integration.
Keys and secrets
- Where secrets live
- Project menu ... → Settings → Environment Variables, scoped to Production, Preview and/or Development; the v0 preview only sees Development variables. Keys are 'stored securely on Vercel'.
- Server-side by default?
- Yes for AI Gateway (OIDC, server-side). For your own env vars, Next.js keeps non-NEXT_PUBLIC_ variables server-only and inlines NEXT_PUBLIC_ ones into the browser bundle at build time.
- How keys end up in the browser
- A NEXT_PUBLIC_ prefix on an AI key. v0 checks for 'Misuse of NEXT_PUBLIC_ variables' and flagged insecure deployments need review before deploy.
The 20 checks, in v0
What v0 does for you, and what to ask it (or your coding agent) to add. Tick them off in the interactive checklist.
Cost and abuse
- Partly
A spending cap per user
Set a daily project budget on the AI Gateway Budgets page (it stops the whole app, not one user), then ask v0: 'Before each streamText call, sum this user's cost today from ai_costs and return a limit message when it's over $2.'
- Partly
Rate limits on every AI endpoint
Add Firewall → Configure → New Rule → Rate Limit on your AI route (Hobby gets one rule, keyed by IP or JA4), and ask v0 to add a per-user limit in the route handler keyed by the signed-in user id.
- Handled
AI keys only on the server
AI Gateway calls run server-side with per-project OIDC tokens and v0 flags NEXT_PUBLIC_ misuse before deploy; if you add your own provider key under Settings → Environment Variables, never give it a NEXT_PUBLIC_ prefix.
- You add it
Retries capped, with a timeout
Ask v0: 'Set maxRetries: 2 and an abort-signal timeout on every generateText and streamText call, and don't retry from the client.' AI Gateway also retries failed BYOK requests with system credentials and charges your credits.
- Handled
A budget alert at each AI provider
Set team and project budgets with 50/75/100% email alerts on the AI Gateway Budgets page; budgets are off by default, BYOK spend isn't counted, and Spend Management's pause doesn't stop AI Gateway usage, so also set provider-side limits for BYOK keys.
Charging for AI use
- You add it
Every AI call charged or deliberately free
Ask v0 to tag each gateway call with a step name and list which ones are charged to users; Custom Reporting can then group spend by tag to find untagged or free calls.
- You add it
Credits deducted on the server, after success
Connect Supabase or Neon from v0's Databases and ask v0 to deduct credits in a server action after the result is saved, in one transaction, with database permissions that block client writes to the balance.
- You add it
Failed AI calls refunded
Ask v0 to catch gateway errors, including a 402 quota_for_entity_exceeded when a budget is hit, and refund reserved credits with the reason.
- You add it
One charge per request, even on a double click
Ask v0 to send a request id from the client, store it with a unique constraint, return the saved result on repeats, and disable the submit button while pending.
A record of every AI result
- Partly
Each AI result stored with its feature, model, prompt version and settings
AI Gateway logs each request's model, tokens and spend, but not your user or prompt version, so ask v0 to save the gateway generation id with feature, model, prompt_version, params, input and user_id on an ai_results row.
- You add it
Retries and corrections saved next to the original, never over it
Ask v0 to save regenerations and edits as new ai_results rows with parent_id and version instead of overwriting.
- You add it
What users do next with each AI result, recorded on the server
Ask v0 to add an ai_events table and a server action recordAiEvent called from the Retry, Edit, Copy and Export buttons.
What worked, for whom, at what cost
- You add it
Worked first time, per feature, model and prompt version
Ask v0 for an admin page showing worked-first-time by feature, model and prompt version for 7 and 30 days.
- Partly
A cost record for every AI step
Pass the user id and a step tag on each gateway request (Custom Reporting) or read cost per generation from Generation Lookup, and store it in an ai_costs row per call, retries included.
- You add it
Wasted AI spend and real cost per result, per feature
Ask v0 for an admin query joining ai_costs and ai_events: total spend, spend on results that didn't work, cost per result that worked, per feature and model.
- You add it
Who the AI fails for
Ask v0 to save language, length band, input kind, plan and new-user flag with each result and show worked-first-time per trait.
Switching safely
- You add it
Prompts in version control, with version labels
Ask v0 to move inline prompts into lib/prompts/ files with exported version labels saved on each result.
- You add it
Model and prompt switchable by a flag
Ask v0 to read the gateway model string and prompt version per feature from an environment variable (Settings → Environment Variables) or a database setting, with a user-id-hashed split.
- You add it
Real past requests to replay before a change
Ask v0 for a script that replays 50 anonymised past requests through any gateway model and prompt version and saves outputs and cost next to the originals.
- You add it
A plan for model shutdowns
Keep every gateway model string in one config file and check it against the AI Gateway model list before switching.
Spending limits in v0
- Spending caps
- AI Gateway budgets per team, project, API key or team member (not end user): daily, weekly, monthly or no reset; soft cap checked before each request; 402 quota_for_entity_exceeded when exceeded; optional email alerts at 50/75/100%; defaults for all projects/keys/members. Dashboard: AI Gateway → Budgets. BYOK spend isn't counted. Vercel Spend Management (Pro) pause does not stop AI Gateway or v0 usage.
- Rate limiting
- Vercel WAF rate limiting on all plans: Firewall → Configure → New Rule → Rate Limit; Hobby 1 rule per project, Pro 40, Enterprise 250; keys IP and JA4 (headers/user agent on Enterprise); window 10s–10min; counters per region. AI Gateway free tier has per-model 429s.
- Cost per user
- Yes via AI Gateway Custom Reporting: attach user IDs and tags to requests and query spend by model, user, tag or provider ($0.075 per 1,000 writes, $5 per 1,000 queries).
- Logs of AI calls
- AI Gateway logs every request: requests by model, time to first token, tokens and spend in the Observability tab (team and project); searchable request logs; Generation Lookup API returns provider, latency, tokens, cost and finish reason per generation; Trace Drains (Pro/Enterprise) export OpenTelemetry.
- Server functions
- Vercel Functions on Fluid compute (default 300s; max 300s Hobby, 800s Pro/Enterprise), Cron Jobs (no automatic retry), Queues, Workflow.
- Database
- v0 Databases: one-click Upstash, Neon, Supabase and Vercel Blob.
If you switch to your own OpenAI key later, these are the limits to set at OpenAI:
- Organisation limit
- https://platform.openai.com/settings/organization/limits → Spend → Edit spend limit → Monthly spend limit → turn on 'Enforce a hard limit' → Save.
- Project limit
- https://platform.openai.com/settings/ → (project) Limits → Spend → Edit spend limit → same steps.
- What happens at the limit
- A spend alert only notifies; traffic continues. A hard limit makes requests return 429 with project_spend_limit_exceeded or organization_spend_limit_exceeded. Enforcement isn't instantaneous, so spend can slightly exceed the limit. Separate codes: organization_usage_limit_exceeded (OpenAI-assigned tier limit) and credit_balance_exhausted (prepaid credits gone).
- Note
- Community threads in 2025–2026 report hard caps disappearing and returning; the current official guide documents them.
- Key scoping
- Keys belong to projects; project service-account keys are unique to their project. Key permissions: All, Restricted or Read Only. Per project, owners can choose allowed models and set a rate limit per model under Limits. (From OpenAI help-center snippets; the page returned 403 to the fetcher.)
- Rate limits
- Set at organization and project level, not per user. Tiers: Free ($100/month usage limit, allowed geography), Build ($5 total credit purchases, $500/month), Launch ($100, $5,000/month), Grow ($500, $200,000/month); upgrades automatically. View at Settings → Organization → Limits (platform.openai.com/settings/organization/limits). The current page no longer uses 'Tier 1–5' names.
- Where usage shows
- Usage at https://platform.openai.com/settings/organization/usage, grouped by project and model. Per-API-key grouping is reported by a third-party summary of OpenAI's changelog, but community threads say some accounts only see project/model; not confirmed in official docs.
developers.openai.com ↗developers.openai.com ↗help.openai.com ↗help.openai.com ↗
Mistakes v0 apps make at launch
AI keys exposed with a NEXT_PUBLIC_ prefix.
Vercel (Aug 4, 2025): v0 blocked over 17k insecure deployments in July 2025 alone, with exposed API keys and NEXT_PUBLIC_ misuse among the most common issues; about a thousand people were about to share OpenAI, Gemini, Claude and xAI keys.
An unauthenticated AI route left over from development.
Vercel Community thread (June–July 2026): a Hobby user saw Anthropic calls to models their app never used; the likely cause was 'an exposed route in my code that should have been removed when moving from dev to prod'. Advice: treat keys as compromised, rotate, authenticate or remove the route.
Assuming Vercel caps AI spend.
AI Gateway budgets are optional and unlimited by default; BYOK spend isn't counted; Spend Management's pause does not stop AI Gateway API key usage or v0 usage.
Questions
How do AI calls work in a v0 app with OpenAI?
v0 apps call OpenAI models through Vercel AI Gateway: no OpenAI account or key, and usage is billed through Vercel AI Gateway.
Can v0 cap AI spending per user?
Partly. Set a daily project budget on the AI Gateway Budgets page (it stops the whole app, not one user), then ask v0: 'Before each streamText call, sum this user's cost today from ai_costs and return a limit message when it's over $2.'
Where should the OpenAI key live in v0?
Handled. AI Gateway calls run server-side with per-project OIDC tokens and v0 flags NEXT_PUBLIC_ misuse before deploy; if you add your own provider key under Settings → Environment Variables, never give it a NEXT_PUBLIC_ prefix.